Computer Hacking Forensic Investigator (CHFI v10) — Question 145

With the standard Linux second extended file system (Ext2fs), a file is deleted when the inode internal link count reaches ________.

Answer options

• A. 0
• B. 10
• C. 100
• D. 1

Correct answer: A

Explanation

The correct answer is A, as a file in Ext2fs is considered deleted when its inode's link count reaches zero, meaning there are no more directory entries pointing to it. Options B, C, and D are incorrect because they do not represent the specific threshold required for the file to be removed from the file system.